Investigating Endpoint Log Deletion for C2 Communication

A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?

IPS
Firewall Source Reference Answer
AСL
Windows security

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests log correlation and incident response procedures when local evidence is destroyed, with the common trap being confusion between network controls and access control lists.

When endpoint logs are tampered with during a C2 investigation, analysts pivot to network-level logging to trace suspicious outbound traffic. The SY0-701 community consistently emphasizes firewall logs as the primary fallback for reconstructing compromised host activity.

Candidates often select ACL (Option C) under the assumption that it tracks log deletion events, but ACLs only filter traffic rather than recording forensic timeline data or connection details.

Community Discussion (4 comments)

Glacier88 👍 1 Selected: B

While the endpoint logs themselves are deleted, the firewall logs might still provide valuable information. Firewalls typically record network traffic, including outbound connections, which could help the analyst identify the destination of the suspicious communication. By examining the firewall logs, the analyst might be able to determine the IP address of the command-and-control server and gather other relevant information about the incident.

Kingamj 👍 4 Selected: B

Since the logs on the endpoint were deleted, the security analyst would likely turn to firewall logs. Firewall logs can provide information about network traffic, including outbound connections that may indicate communication with a command-and-control server. These logs can help the analyst identify suspicious traffic patterns or unauthorized communication that bypassed endpoint defenses.

1edea48 👍 2

This isn't correct. The answer has to be C. In the question, it specifically states that the logs on the endpoint were deleted. That tells me that someone had access to those logs, which means there might have very well been tampering on the endpoint. The ACL has the ability to show us who was able to access those logs and when they were deleted.

a4e15bd 👍 1

B. Firewall

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

When an attacker deletes local endpoint logs to cover their tracks, the analyst must immediately shift focus to centralized or network-perimeter logging sources. Firewall logs capture source/destination IPs, ports, protocols, and timestamps for all traversing traffic, making them ideal for identifying unauthorized outbound C2 communications. This aligns with standard incident response playbooks that prioritize preserving and analyzing network telemetry when host-based data is unavailable.

Why the Other Options Are Wrong

IPS logs (A) primarily record detected signatures and alerts rather than comprehensive connection metadata needed for full traffic reconstruction. ACLs (C) define permit/deny rules but do not generate audit trails of who modified logs or specific connection sessions. Windows Security logs (D) reside on the compromised endpoint and have already been deleted by the adversary, rendering them useless for this specific recovery step.

Community Comment Notes

Comment [1] correctly highlights that firewall logs reveal outbound patterns indicating C2 activity despite endpoint tampering. Comment [3] reinforces this by noting how perimeter logs help identify the malicious destination IP. While comment [2] suggests ACLs track log deletion, this misinterprets ACL functionality, which strictly governs traffic flow rather than system auditing.

Official Reference

Exam Strategy

Always follow the principle of centralized logging in your exam answers; when local evidence is gone, pivot to network or SIEM sources. Look for keywords like "outbound," "command-and-control," and "logs deleted" to quickly eliminate host-based options and select perimeter monitoring tools.

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide